The problem w/ the 18.104.22.168 build turns out to be a conditional in ssb.h. The kernel config has CONFIG_SSB_PCIHOST=y, but the makefile for b43 doesn't have it set. Consequently, the ssb_device structure for the ssb driver and b43 end up being different sizes. That was why the b43 from the kernel tree worked.
Anyway, if you add the following patch, b43 now runs on my whr-hp-g54 (bcm5352). The firmware loads and it scans.
However, my wl520gu (bcm5354) randomly reboots or hangs at b43/main.c:1037. I'll salt it with some printk's and post the problem.
The integration of compat-wireless seems a little fragile. For instance, the mac80211 header from the kernel tree is used for the b43 build, but the header from compat-wireless is used for mac80211 and cfg80211. Apparently, all the dependent pieces, like ssb, b43, mac80211, etc. were intended to be build as modules in the compat-wireless tree. However, for an embedded system, the ssb driver has to be build-in. I'm not sure what a tidy solution might be.
--- package/b43/Makefile (revision 11427)
+++ package/b43/Makefile (working copy)
@@ -45,6 +45,7 @@
+ CONFIG_SSB_PCIHOST=y \
$(if $(CONFIG_RFKILL),CONFIG_B43_RFKILL=y) \
$(if $(CONFIG_LEDS_TRIGGERS),CONFIG_B43_LEDS=y) \